Nginx如何配置多个域名不同SSL证书？单服务器多证书实战指南

/etc/nginx/
├── ssl/                     # 所有证书根目录（禁止直接放 .pem！）
│   ├── example.com/         # 每域名独立子目录
│   │   ├── fullchain.pem    # 证书链（含根+中间CA）
│   │   ├── privkey.pem      # 私钥（必须 600 权限！）
│   │   └── README.md        # 记录签发时间、CA、到期日、负责人
│   ├── api.example.com/
│   │   ├── fullchain.pem
│   │   ├── privkey.pem
│   │   └── README.md
│   └── client-b.com/
│       ├── fullchain.pem    # 第三方提供证书
│       ├── privkey.pem
│       └── README.md
├── conf.d/
│   ├── ssl-mapping.conf     # map 证书路径的核心配置
│   ├── sites-enabled/
│   │   ├── example.com.conf
│   │   ├── api.example.com.conf
│   │   └── client-b.com.conf
└── nginx.conf               # 主配置，include ssl-mapping.conf

#!/bin/bash
# secure-certs.sh - 运行于 certbot/acme.sh hook 中
CERT_DIR="/etc/nginx/ssl"
NGINX_USER="www-data"  # Ubuntu/Debian 默认用户

find "$CERT_DIR" -name "privkey.pem" -exec chmod 600 {} \;
find "$CERT_DIR" -name "fullchain.pem" -exec chmod 644 {} \;
chown -R "$NGINX_USER":"$NGINX_USER" "$CERT_DIR"

# === SSL Certificate Mapping by SNI ===
# 使用 map 指令将域名映射到证书路径
# 注意：map 必须在 http{} 块顶层定义，不可在 server{} 内

map $ssl_server_name $upstream_cert {
    # 默认兜底证书（可选，用于未匹配域名的友好提示）
    default                          "/etc/nginx/ssl/_default/fullchain.pem";

    # 主站
    example.com                        "/etc/nginx/ssl/example.com/fullchain.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/fullchain.pem";

    # API 服务
    api.example.com                    "/etc/nginx/ssl/api.example.com/fullchain.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/fullchain.pem";

    # 运营后台
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/fullchain.pem";

    # 白标客户
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/fullchain.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/fullchain.pem";

    # 国密证书（SM2）站点 —— 需 Nginx with OpenSSL 3.0+ & GMSSL
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/fullchain_sm2.pem";
}

map $ssl_server_name $upstream_key {
    default                          "/etc/nginx/ssl/_default/privkey.pem";
    example.com                        "/etc/nginx/ssl/example.com/privkey.pem";
    www.example.com                    "/etc/nginx/ssl/example.com/privkey.pem";
    api.example.com                    "/etc/nginx/ssl/api.example.com/privkey.pem";
    staging-api.example.com            "/etc/nginx/ssl/api.example.com/privkey.pem";
    admin.example.com                  "/etc/nginx/ssl/admin.example.com/privkey.pem";
    client-a.brandpartner.net          "/etc/nginx/ssl/client-a.brandpartner.net/privkey.pem";
    client-b.brandpartner.net          "/etc/nginx/ssl/client-b.brandpartner.net/privkey.pem";
    sm2.example.com                    "/etc/nginx/ssl/sm2.example.com/privkey_sm2.pem";
}

# 可选：根据域名启用不同 TLS 版本（如国密站强制 TLSv1.3）
map $ssl_server_name $tls_protocols {
    default                          "TLSv1.2 TLSv1.3";
    sm2.example.com                    "TLSv1.3";
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    # 关键：动态证书路径
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;
    ssl_protocols       $tls_protocols;

    # 域名匹配（SNI 已由上层 map 解析，此处仅做路由）
    server_name api.example.com staging-api.example.com;

    # 强制 HSTS（生产环境必开）
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # OCSP Stapling 加速证书状态验证
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 1.1.1.1 valid=300s;
    resolver_timeout 5s;

    # 安全头
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;

    # Java 后端代理（示例：Spring Boot 微服务）
    location / {
        proxy_pass https://backend-java-cluster;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 传递客户端证书（如需双向认证）
        proxy_ssl_verify off; # 生产请开启并配置 ca.crt
    }

    # 健康检查端点（不走 Java 逻辑，Nginx 直答）
    location /healthz {
        return 200 'OK';
        add_header Content-Type text/plain;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 客户提供证书，可能为 OV 或 EV，需特殊 Header
    server_name client-b.brandpartner.net;

    # 客户要求：暴露证书信息至响应头（合规审计用）
    ssl_certificate_info on; # Nginx 1.19.7+
    add_header X-Cert-Issuer $ssl_client_i_dn_o;
    add_header X-Cert-Subject $ssl_client_s_dn_cn;

    location / {
        # 代理至客户指定后端（可能是 Java Tomcat 集群）
        proxy_pass http://client-b-tomcat;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 检查语法
sudo nginx -t

# 查看当前加载的证书映射（调试用）
sudo nginx -T 2>/dev/null | grep -A5 "map \$ssl_server_name"

# 测试特定域名证书是否匹配
openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

server:
  forward-headers-strategy: framework  # 启用 Spring 对 X-Forwarded-* 的解析

# 若使用 Tomcat（默认）
server:
  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto
    internal-proxies: 127\.0\.0\.1|::1|10\.0\.0\.0/8|172\.16\.0\.0/12|192\.168\.0\.0/16

@Configuration
public class WebConfig implements WebMvcConfigurer {

    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
        // 开启 HTTP 重定向到 HTTPS（仅当 Nginx 未做时启用）
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }

    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080); // Nginx 将 80→443，此端口仅内部访问
        connector.setSecure(false);
        connector.setRedirectPort(8443); // 此端口实际由 Nginx 终结
        connector.setProperty("proxyPort", "443");
        connector.setProperty("proxyName", "api.example.com");
        return connector;
    }

    // ✅ 关键：覆盖默认 ForwardedHeaderFilter，添加 X-Forwarded-Host 支持
    @Bean
    public Filter forwardedHeaderFilter() {
        ForwardedHeaderFilter filter = new ForwardedHeaderFilter();
        filter.setTrustedProxies(Pattern.compile("127\\.0\\.0\\.1|10\\.\\d+\\.\\d+\\.\\d+|172\\.(1[6-9]|2[0-9]|3[0-1])\\.\\d+\\.\\d+|192\\.168\\.\\d+\\.\\d+"));
        return filter;
    }
}

@RestController
public class UrlController {

    @GetMapping("/debug/url")
    public Map<String, String> debugUrl(HttpServletRequest request) {
        Map<String, String> info = new HashMap<>();
        info.put("scheme", request.getScheme());                    // ✅ 返回 "https"
        info.put("serverName", request.getServerName());            // ✅ 返回 "api.example.com"
        info.put("requestURL", request.getRequestURL().toString()); // ✅ 返回 "https://api.example.com/debug/url"
        info.put("forwardedProto", request.getHeader("X-Forwarded-Proto")); // "https"
        info.put("forwardedHost", request.getHeader("X-Forwarded-Host"));     // "api.example.com"
        return info;
    }

    // ✅ 安全重定向：自动使用 HTTPS 协议
    @GetMapping("/secure-redirect")
    public ResponseEntity<Void> secureRedirect() {
        return ResponseEntity.status(HttpStatus.MOVED_PERMANENTLY)
                .header(HttpHeaders.LOCATION, "/dashboard") // Spring 自动补全 scheme+host
                .build();
    }
}

@Component
public class ClientIpResolver {

    public String getClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("X-Real-IP");
        }
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        // 取第一个 IP（XFF 可能为 "a,b,c"）
        if (ip != null && ip.contains(",")) {
            ip = ip.split(",")[0].trim();
        }
        return ip;
    }
}

curl https://get.acme.sh | sh
source ~/.acme.sh/acme.sh.env
acme.sh --set-default-ca --server letsencrypt

# 假设使用阿里云 DNS
export Ali_Key="your_access_key"
export Ali_Secret="your_access_secret"

acme.sh --issue \
  -d api.example.com \
  -d staging-api.example.com \
  --dns dns_ali \
  --keylength ec-256 \
  --pre-hook "/usr/local/bin/secure-certs.sh" \
  --deploy-hook "/usr/local/bin/reload-nginx.sh"

#!/bin/bash
# /usr/local/bin/reload-nginx.sh

DOMAIN=$1  # acme.sh 传入的域名
CERT_DIR="/etc/nginx/ssl/$DOMAIN"
NGINX_CONF="/etc/nginx/conf.d/ssl-mapping.conf"

# 创建域名目录
mkdir -p "$CERT_DIR"

# 复制证书（acme.sh 输出路径固定）
cp "$HOME/.acme.sh/$DOMAIN/fullchain.cer" "$CERT_DIR/fullchain.pem"
cp "$HOME/.acme.sh/$DOMAIN/$DOMAIN.key" "$CERT_DIR/privkey.pem"

# 权限加固
chmod 600 "$CERT_DIR/privkey.pem"
chmod 644 "$CERT_DIR/fullchain.pem"
chown www-data:www-data "$CERT_DIR" "$CERT_DIR/*"

# ✅ 关键：自动更新 ssl-mapping.conf 中的 map 条目
# 使用 sed 在 map 块中追加或替换（生产环境建议用更健壮的 awk/python 脚本）
if ! grep -q "$DOMAIN" "$NGINX_CONF"; then
    sed -i "/default.*;/a \    $DOMAIN                        \"\/etc\/nginx\/ssl\/$DOMAIN\/fullchain.pem\";" "$NGINX_CONF"
    sed -i "/default.*;/a \    $DOMAIN                        \"\/etc\/nginx\/ssl\/$DOMAIN\/privkey.pem\";" "$NGINX_CONF"
fi

# 语法检查 + 重载
if nginx -t 2>/dev/null; then
    systemctl reload nginx
    echo "✅ Nginx reloaded for $DOMAIN"
else
    echo "❌ Nginx config error for $DOMAIN"
    exit 1
fi

# crontab -e
0 3 * * * "/root/.acme.sh/acme.sh" --cron --home "/root/.acme.sh" > /var/log/acme.sh.log 2>&1

# /etc/nginx/conf.d/sm2.example.com.conf
server {
    listen 443 ssl http2;
    listen 4433 ssl http2;  # 国密专用端口

    # 匹配国密证书
    ssl_certificate     $upstream_cert;
    ssl_certificate_key $upstream_key;

    # 强制国密套件
    ssl_ciphers ECDHE-SM2-WITH-SMS4-SM3:ECDHE-SM2-WITH-SMS4-GCM-SM3;
    ssl_prefer_server_ciphers off;

    # ALPN 声明（国密客户端识别）
    ssl_alpn_protocols "sm2";

    server_name sm2.example.com;

    location / {
        proxy_pass https://sm2-java-backend;
        proxy_ssl_protocols TLSv1.3;
        proxy_ssl_ciphers ECDHE-SM2-WITH-SMS4-GCM-SM3;
        proxy_ssl_verify off;
    }
}

<!-- pom.xml -->
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk15on</artifactId>
    <version>1.70</version>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.70</version>
</dependency>

@Configuration
public class Sm2Config {

    @Bean
    public SSLContext sm2SslContext() throws Exception {
        Security.addProvider(new BouncyCastleProvider());
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        try (InputStream is = getClass().getResourceAsStream("/sm2/keystore.p12")) {
            keyStore.load(is, "password".toCharArray());
        }

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
        kmf.init(keyStore, "password".toCharArray());

        SSLContext context = SSLContext.getInstance("TLSv1.3");
        context.init(kmf.getKeyManagers(), null, new SecureRandom());
        return context;
    }
}

# 在 http{} 块中定义 log_format
log_format cert_info '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'cert="$ssl_server_name" '
                     'not_after="$ssl_certificate_not_after"';

access_log /var/log/nginx/access.log cert_info;

# alert.rules
groups:
- name: ssl-certificate-alerts
  rules:
  - alert: SSLCertificateExpiringSoon
    expr: (time() - nginx_ssl_certificate_not_after{job="nginx"}) / 3600 < 168
    for: 1h
    labels:
      severity: warning
    annotations:
      summary: "SSL certificate for {{ $labels.cert }} expires in less than 7 days"
      description: "Certificate for {{ $labels.cert }} expires at {{ $value }}"

  - alert: SSLCertificateExpired
    expr: time() > nginx_ssl_certificate_not_after{job="nginx"}
    for: 5m
    labels:
      severity: critical
    annotations:
      summary: "SSL certificate for {{ $labels.cert }} has expired"

@Component
public class CertificateHealthIndicator implements HealthIndicator {

    private final String CERT_PATH = "/etc/nginx/ssl/example.com/fullchain.pem";

    @Override
    public Health health() {
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            try (InputStream is = Files.newInputStream(Paths.get(CERT_PATH))) {
                X509Certificate cert = (X509Certificate) cf.generateCertificate(is);
                Date notAfter = cert.getNotAfter();
                long daysLeft = TimeUnit.MILLISECONDS.toDays(notAfter.getTime() - System.currentTimeMillis());
                if (daysLeft < 7) {
                    return Health.down()
                            .withDetail("certificate", CERT_PATH)
                            .withDetail("expiresInDays", daysLeft)
                            .withDetail("notAfter", notAfter.toString())
                            .build();
                }
            }
            return Health.up().build();
        } catch (Exception e) {
            return Health.down().withException(e).build();
        }
    }
}